[PROOF-P0-S3] Run the suite on pull requests

[d6veteran]

Stage P0-S3 of the plan docs/plan/2026-10-12-any-document-as-a-proof.md.

What

Adds .github/workflows/suite.yml. It runs bash tests/run.sh on every pull request and on every push to main, and shows the result as the check suite / bash tests/run.sh. A pull request is checked as GitHub would merge it into its base, so the result is for the merged tree.

Nothing else changes. The stage's file scope is .github/workflows/.

How it is set up

• The job reads the repository (contents: read), uses no secret, and has a 10 minute limit.
• The runner image is ubuntu-24.04, not ubuntu-latest, so Bash, python3, and node change when this file changes.
• Ruff is pinned to 0.15.15, the version the suite passes with on the author's machine. CI is set on a runner, so a missing Ruff fails the suite (section 20).
• zsh is installed when the image does not have it, so section 15 runs the skills' commands under zsh instead of skipping it.
• There is no path filter, so the check is never "expected" on a pull request it skipped.

If this fails

• A broken workflow file shows as a failed check on each pull request and on main. It does not block a merge, because no branch protection requires it. Nothing deploys from it.
• The check can go red for a reason that is not in the pull request: a runner image change, or a new Ruff. Both are pinned, so it should not.

Rollback runbook

1. Revert the merge: git revert -m 1 <merge commit> on main, and push it through a pull request.
2. Or delete .github/workflows/suite.yml. Without the file no check runs, and no other file refers to it.
3. If the check is later made required in branch protection, remove it there first, or every pull request waits for a check that never runs.

Shown

• This pull request: the check suite / bash tests/run.sh ran on the merged tree and passed: 478 passed, 0 failed, 69 waiting for their stage (the same counts as on a Mac). Run 38321191469.
• A scratch branch with one deliberately failing check (pull request [scratch] PROOF-P0-S3 red check, never merge #29, now closed, branch deleted, never merged): the check turned red with 478 passed, 1 failed, the deliberate check. Run 38321268523.
• On the runner: Bash 5.2, Python 3.12, node 22, git 2.55. The image has no zsh, so the install step is needed: without it section 15 skips its zsh checks.

🤖 Generated with Claude Code